CVE-2006-0725: PHP remote file inclusion vulnerability in prepend.php in Plume CMS 1.0.2, when register_globals is enabled...

Security readout for executives and security teams

This is an old Plume CMS vulnerability affecting version 1.0.2 when PHP register_globals is enabled. A remote attacker could make the application include a file from an attacker-controlled URL through the _PX_config[manager_path] parameter. The main business risk is compromise of forgotten legacy websites still running this CMS and unsafe PHP settings. Exposure is likely limited to legacy Plume CMS 1.0.2 deployments, especially public PHP sites with register_globals enabled. The provided CVE data does not identify current supported products, CPEs, or affected hosting platforms. Treat this as high priority only if legacy Plume CMS is present. Most modern environments should have low practical exposure, but any internet-facing match deserves urgent removal or containment because the weakness can let attackers make the site load remote files. Mitigation focus: Identify and retire or upgrade any Plume CMS 1.0.2 installations.; Apply the vendor prepend.php update if still available and applicable.; Disable PHP register_globals wherever present..

Prepared

Jun 29, 2026, 14:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.